Christina Cacioppo and the Problem She Could Not Leave Alone
Christina Cacioppo Founder and CEO, Vanta
Christina Cacioppo founded Vanta in 2018 after working in product management at Dropbox, where she encountered the manual security and compliance processes that inspired the company. Before Dropbox, she worked on the investment team at Union Square Ventures. She holds a B.A. in Economics and an M.S. in Management Science and Engineering from Stanford University.
Inside Compliance — The people and companies building the compliance industry, and turning technology into legacy.
At eleven years old, Christina Cacioppo discovered the peculiar satisfaction of finding something people wanted and figuring out how to bring the two sides together.
She began selling Beanie Babies on eBay.
It was a small enterprise, but it introduced her to something that would remain a feature of her working life: curiosity about how things move, how people make decisions and how a seemingly ordinary problem can contain the beginnings of a much larger idea.
Cacioppo grew up in Ohio, the daughter of two university professors of psychology. For much of her childhood, she assumed that becoming a professor was simply what adults did. By the time she was finishing her undergraduate degree at Stanford, she had developed a different idea of what her working life might look like.
She studied economics, followed by a master's degree in Management Science and Engineering, and then moved into venture capital. From 2010 to 2012, she worked as an analyst at Union Square Ventures, where her days were spent meeting young companies, studying their ideas and asking founders questions about what they were building. She later described the work as being somewhat like academia: an opportunity to move from one interesting person to another, learning as she went.
Eventually, observing other people build companies became less compelling than trying to build something herself.
Learning to build
In 2013, Cacioppo left venture capital and began working with her Stanford classmate Matt Spitz on a collection of early software ideas under the name Nebula Labs.
The company did not become the lasting business they had hoped for, although the experience would prove important. Spitz would later become Vanta's head of engineering, and the years spent experimenting with software gave Cacioppo an early education in the difference between an interesting idea and something people genuinely want.
Her next chapter took her to Dropbox.
In 2014, she joined the company as a product manager working on Dropbox Paper, its collaborative document product. The job placed her close to the practical questions that arise when software moves from an idea on a screen into the hands of businesses and their customers.
One of those questions arrived through Dropbox's legal team.
Cacioppo was speaking with customers about Dropbox Paper when she learned that some of the security commitments contained in Dropbox's customer contracts did not yet extend to the new product. She began looking more closely at the standards and processes behind those commitments and found an industry relying heavily on spreadsheets, screenshots and folders of evidence.
The contrast stayed with her.
Technology companies were becoming increasingly sophisticated at building, storing and moving information, while the process of demonstrating that their systems were secure still depended on a great deal of manual work. Forbes reported that Cacioppo found the process tedious, error-prone and surprisingly disconnected from the automation taking place elsewhere in the technology industry.
The question was simple enough to carry with her.
Could software make this easier?
Finding the company
Cacioppo left Dropbox in 2016 and began exploring what would eventually become Vanta with Erik Goldman.
The answer did not arrive immediately.
The pair spent months considering different ideas and talking to people across the technology industry. Their exploration included concepts far removed from compliance, including an idea Forbes described as an Amazon Alexa for biologists.
The important part was the process. They spent time understanding problems before committing themselves to building a particular solution.
Eventually, their conversations with security professionals kept returning to the same opportunity. Businesses needed to demonstrate that they were protecting customer information, but the work involved in gathering and maintaining that evidence consumed significant amounts of time.
The problem was established.
The opportunity was beginning to take shape.
Vanta was founded in 2018.
The woman behind the “automated” email
There is a small story from Vanta's earliest days that offers an unusually intimate view of Cacioppo's approach to building.
The company had begun sending customers a daily email summarizing activity in their Vanta account.
The email looked automated.
Behind the scenes, Cacioppo was waking up at 5:45 in the morning and writing it herself.
She wanted to know whether customers valued the information before spending time building software to automate it. Once the team understood what customers wanted, they wrote the code, and Forbes reported that the resulting system required remarkably little change for roughly a year and a half.
The story is memorable because of its scale.
The company that would eventually become a major software business began with its chief executive sitting down before sunrise to write emails by hand.
There is also something revealing in the order of operations. Cacioppo wanted to understand the customer before optimizing the machinery around the customer.
That instinct appears repeatedly in accounts of her career.
When Vanta needed a pricing model for enterprise customers, she spent a weekend reading books about pricing and then spoke with customers about what they considered expensive. The resulting model remained in place for roughly two years, according to Forbes.
The pattern is consistent: encounter a subject, immerse yourself in it, ask people questions, form a view and then build.
From compliance to trust
Vanta's first opportunity was security compliance, including standards such as SOC 2 and ISO 27001.
The underlying proposition was straightforward. Companies needed to demonstrate that they had appropriate security controls in place, and Vanta could automate much of the evidence gathering and monitoring required to demonstrate that work.
The significance of the idea became clearer as Vanta grew.
Compliance can determine whether a company wins a customer. A large enterprise may want evidence of a supplier's security practices before signing a contract. A growing software company may need a SOC 2 report to move into larger markets. A procurement team may require documentation from every technology vendor it considers.
What appears to be administrative work from inside a company can become part of the machinery through which that company grows.
Cacioppo and her team were building software around that reality.
By 2021, Vanta had become one of the prominent companies in the emerging category of automated security and compliance software. Forbes reported that the company had more than 1,500 customers that year, including technology companies such as Notion, Lattice and Loom.
The category itself was beginning to expand.
Companies including Drata and Secureframe entered the market, while established governance and risk-management businesses occupied adjacent territory. Cacioppo had helped identify a problem, and the market was responding to it.
The scale of the idea
Vanta's growth accelerated.
The company raised $110 million in 2022 at a valuation of $1.6 billion, according to Forbes. In 2024, it announced another $150 million round at a $2.45 billion valuation, bringing its total funding to $353 million. At that point Vanta reported more than 8,000 customers and around 500 employees.
The numbers tell one story.
The other is about the expansion of the original idea.
Vanta began by helping companies automate security compliance. Its platform has since grown into a broader trust and security system, with capabilities around areas such as vendor risk management, trust centers and security questionnaires. The company now describes its mission in terms of helping businesses “build, maintain and demonstrate trust.”
That language matters because it reflects a broader shift in the industry.
Compliance is traditionally associated with proving that a company has met a defined set of requirements at a particular point in time.
Trust is more continuous.
Customers want to understand how a company operates today. Security teams want visibility into changing systems and vendors. Procurement teams want current information about the companies they rely upon. The evidence needs to move with the business.
Vanta has increasingly positioned itself around that continuous relationship between a company's operations and the evidence it can provide about them.
The habits of a builder
The more interesting details of Cacioppo's career tend to be found in the small decisions.
She has maintained a reputation for researching subjects deeply before making decisions. Sequoia partner Andrew Reed, who has worked with her as an investor and board member, told Forbes that she conducts extensive research before forming a point of view and making major decisions.
There is a certain consistency between that description and the early stories from Vanta.
The founder who spent months talking to security professionals before writing the first version of the product became the chief executive who would later spend a weekend reading about pricing before setting the company's enterprise model.
The subject changes.
The method remains.
Curiosity becomes research. Research becomes a point of view. The point of view becomes a product.
A company shaped by its founder
Cacioppo has also maintained a distinctive attitude toward the culture surrounding Vanta.
Forbes has written about the company's early frugality, including buying coffee in bulk from Costco and maintaining a deliberately restrained approach to office spending. Cacioppo described the philosophy as a willingness to spend when spending would help the company grow, while preserving the discipline that had characterized its early years.
The detail is almost charmingly mundane, but it belongs in the story because businesses eventually acquire the habits of their founders.
The same company that once depended on its founder's 5:45 a.m. emails grew into an organization with hundreds of employees, international operations and thousands of customers.
Yet the underlying preference for understanding the economics of a decision before making it remained visible.
Perhaps that is one of the more difficult transitions in a founder's life: preserving the curiosity and discipline that helped create the company while learning how to operate at a scale where the founder can no longer personally see everything.
The next version of trust
The compliance industry is now entering another period of change.
Artificial intelligence has altered how companies build software, how employees work and how businesses think about security. It has also created new questions around governance, data, access and risk.
Vanta's current strategy reflects that shift.
The company now describes its platform as an “Agentic Trust Platform” and says it is moving toward a model in which trust can be monitored continuously across a company's systems, controls, vendors and compliance obligations. In a recent company update, Vanta said it had crossed $300 million in annual recurring revenue and had more than 16,000 customers. Those figures are company-reported.
The language has changed considerably from the early days of spreadsheets and screenshots.
The underlying question has remained remarkably consistent.
How does a company prove that it can be trusted?
What remains after the product changes
It is tempting to look at a technology company through its products, funding rounds and valuation.
Those things are important, but they rarely explain why a company came into existence in the first place.
In Cacioppo's case, the origin story is unusually clear.
A product manager at Dropbox encountered a process that seemed out of step with the technology surrounding it. She became curious about why it worked that way. She left her job, spent months speaking with people who understood the problem, and eventually began building a company around the answer.
The company grew because the problem was real.
The market grew because more businesses encountered the same problem.
And the product evolved because the meaning of trust continued to expand.
Cacioppo's story therefore belongs to a larger history of technology: the history of people who look at an ordinary process and recognize that it is ready to change.
The Beanie Babies were a small beginning.
The spreadsheets at Dropbox were another.
The 5:45 a.m. emails were another.
Each one was an exercise in paying attention.
That may be the most interesting thread running through Cacioppo's career. Her work has repeatedly begun with the same instinct that led an eleven-year-old to start selling toys online: look closely at how something works, understand what people value, and find the opportunity hidden inside the details.
Vanta began with compliance.
It has grown into a company concerned with trust.
And the larger legacy may ultimately belong to the idea behind both: that businesses should have better ways to demonstrate, continuously and clearly, that they are worthy of the confidence placed in them.
That is a problem large enough to build a company around.
And perhaps large enough to build a career around as well.